CVE-2026-9620: WP Latest Posts Plugin XSS Vulnerability

CVE-2026-9620 Overview

CVE-2026-9620 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Latest Posts plugin for WordPress, affecting all versions up to and including 5.0.11. The flaw resides in the field() and loop() functions, which extract raw src attribute values from <img> tags in post content using a regular expression and concatenate the unescaped values into new HTML elements. This processing path bypasses WordPress's kses filtering. Authenticated attackers with author-level access or above can inject arbitrary JavaScript that executes when other users view the affected pages. The vulnerability is classified under CWE-79.

Critical Impact
Authenticated authors can store JavaScript payloads that execute in the browsers of site visitors, including administrators, enabling session theft and account takeover.

Affected Products

WP Latest Posts plugin for WordPress, versions up to and including 5.0.11
WordPress sites granting author-level or higher capabilities to untrusted users
WordPress installations relying on kses filtering for content sanitization

Discovery Timeline

2026-06-24 - CVE-2026-9620 published to the National Vulnerability Database (NVD)
2026-06-25 - CVE-2026-9620 last updated in NVD database

Technical Details for CVE-2026-9620

Vulnerability Analysis

The WP Latest Posts plugin renders post listings by extracting image URLs from each post's post_content. Instead of using WordPress's sanitization pipeline, the plugin applies a regular expression to locate <img> tags and pulls the src attribute as a raw string. The plugin then reconstructs new <img> elements or background-image CSS declarations using direct string concatenation.

Because the extracted value is never passed through esc_attr(), esc_url(), or the kses filter, an attacker can craft a src value that closes the attribute and injects arbitrary attributes or script content. The injected payload is stored in the database and rendered on every page that displays the post via WP Latest Posts widgets or shortcodes.

Root Cause

The root cause is insufficient output escaping in the field() and loop() functions within inc/wplp-front.inc.php. Affected lines 2284, 2326, and 2738 reconstruct HTML output from regex-extracted attribute data without re-applying WordPress's sanitization functions. See the WordPress plugin source reference for the affected code.

Attack Vector

An authenticated user with author-level or higher privileges creates a post containing an <img> tag whose src attribute is crafted to break out of the attribute context. When any visitor loads a page that renders the post through WP Latest Posts, the injected script executes in the victim's browser session. The scope change in the CVSS vector reflects impact on visitors beyond the vulnerable component.

Detection Methods for CVE-2026-9620

Indicators of Compromise

Posts authored by lower-privileged users containing <img> tags with unusual quote sequences, event handlers, or javascript: URIs in the src attribute
Unexpected outbound requests from administrator browser sessions to attacker-controlled domains shortly after viewing WP Latest Posts widgets
New or modified administrator accounts created without authorized workflow approval

Detection Strategies

Query the wp_posts table for post_content entries containing suspicious src patterns such as onerror=, onload=, or quote-escaping sequences
Inspect rendered HTML on pages using WP Latest Posts widgets or shortcodes for malformed <img> markup or inline <script> tags
Review web server access logs for unusual requests originating from administrator sessions after viewing public pages

Monitoring Recommendations

Enable WordPress audit logging to capture post creation and edit events by author-level accounts
Monitor plugin file integrity for inc/wplp-front.inc.php until an upstream fix is applied
Alert on creation of new administrator users or modifications to existing administrator capabilities

How to Mitigate CVE-2026-9620

Immediate Actions Required

Update WP Latest Posts to a version newer than 5.0.11 when the vendor publishes a patched release
Audit existing posts and pages for malicious <img> payloads injected by author-level users
Review the author-level user roster and revoke access for accounts that are not actively required

Patch Information

At the time of publication, no fixed version is documented in the NVD record. Site operators should monitor the Wordfence vulnerability report and the WP Latest Posts plugin repository for an updated release that applies proper escaping in the field() and loop() functions.

Workarounds

Disable the WP Latest Posts plugin until a patched version is released
Restrict author-level and higher capabilities to trusted users only, removing the prerequisite for exploitation
Deploy a web application firewall (WAF) rule that blocks <img> tags containing event handler attributes or javascript: URIs in post_content submissions
Enforce Content Security Policy (CSP) headers that disallow inline scripts to limit payload execution

bash

# Temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate wp-latest-posts

# Audit posts for suspicious img src patterns
wp db query "SELECT ID, post_author, post_title FROM wp_posts WHERE post_content REGEXP '<img[^>]*src=[^>]*(onerror|onload|javascript:)';"